Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flaws in deterministic password managers

tonyarcieri.com

Post reply on HN
Print view View original

61–70 of 106 posts

Re: Flaws in deterministic password managers

#61

Post by eridius »

ythn wrote: post #49
eridius wrote: post #19

Earlier quoted context omitted.

What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).

It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc

Yes, I know that Otto is Italian for 8. But even if I convert the italian word to the number, it doesn't make sense, because "8" doesn't have digits on either side of the digit so there's nothing to sum up.

Re: Flaws in deterministic password managers

#62

Post by __jal »

Gruselbauer wrote: post #45
pwinnski wrote: post #26

Today I learned that many people on Hacker News have really insecure web security practices. :( I don't understand the resistance to using a vault-based password manager. Is it inertia? I mean, if you're using the same one or two passwords on every site, then sure, it may not seem worthwhile to us 1Password. But then, enough password hashes have been leaked this year alone to suggest that you need to do something bet…

For me it was a case of thinking I know better. As in, "no way I'm giving you my passwords" and "who knows how tight their opsec is" ... never even tried anything like LastPass or 1Password until six months ago. Now I cannot imagine going back. My LastPass subscription is among the most vital services I pay for and the sheer freedom of having to remember one diceware-style master password instead of maintaining my ow…

> So if you cracked my LastPass vault - good luck with that, 2FA considered

Well, the traditional[1] way to break[2] LastPass is to ignore individual accounts and go after poor coding technique[3]. 2FA won't help you there.

[1] https://www.wired.com/2015/06/hack-brief-password-manager-la...

[2] https://techcrunch.com/2011/05/05/password-manager-last-pass...

[3] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...

Re: Flaws in deterministic password managers

#63

Post by Nomentatus »

ogrisel wrote: post #27
libeclipse wrote: post #2

I'm the creator of visionary[0], a deterministic password generator that the article links to. When I thought of the idea (quite a while ago), I thought it was a good idea, and I thought I was the first one there. I was wrong on both accounts. The points that the article makes are right, and people should use conventional passwords over deterministic ones. But I guess it appeals to a certain small subset of people. F…

Funny, I also implemented mine a while ago (mostly un-maintained but I still use it): https://pypi.python.org/pypi/virtualkeyring/ I also thought I was clever and the first to do it ;) I have been thinking about adding support to keep some state info in a yaml file to deal with revocation and specific varying password policies (e.g. in a dropbox synced folder) but I was too lazy to implement it. If someone wants to d…

Use a photo as the master password. It can't be confused with text.

Re: Flaws in deterministic password managers

#64

Post by hackuser »

Gee19 wrote: post #58
hackuser wrote: post #55

Earlier quoted context omitted.

> the more "useful" they become, with browser extensions etc., the greater the attack surface becomes Also, the more popular the password manager becomes, the more valuable cracking it becomes. One exploit can yield the email, banking, workplace, confidential document, and other passwords for many millions of people. If you are an attacker, it would be worth it to have the exploit on file, proactively, for the next t…

This is only true for cloud based password managers. I recommend using 1Password or KeePassX with Dropbox.

> This is only true for cloud based password managers

I agree, in the sense that one successful attack on the supposed centralized database containing all user credentials would have a high ROI.

But it also applies to local password managers. If 20 million people use the same password manager and I have an exploit for it, if I'm in the business of stealing data I'm likely to find a use for my exploit.

Re: Flaws in deterministic password managers

#65

Post by minitech »

libeclipse wrote: post #2

I'm the creator of visionary[0], a deterministic password generator that the article links to. When I thought of the idea (quite a while ago), I thought it was a good idea, and I thought I was the first one there. I was wrong on both accounts. The points that the article makes are right, and people should use conventional passwords over deterministic ones. But I guess it appeals to a certain small subset of people. F…

This change seems kind of worrying: https://github.com/libeclipse/visionary/pull/40/files#r79336...

The distribution of characters in “complex passwords” isn’t even?

Re: Flaws in deterministic password managers

#66

Post by krick »

Gee19 wrote: post #58
hackuser wrote: post #55

Earlier quoted context omitted.

> the more "useful" they become, with browser extensions etc., the greater the attack surface becomes Also, the more popular the password manager becomes, the more valuable cracking it becomes. One exploit can yield the email, banking, workplace, confidential document, and other passwords for many millions of people. If you are an attacker, it would be worth it to have the exploit on file, proactively, for the next t…

This is only true for cloud based password managers. I recommend using 1Password or KeePassX with Dropbox.

Maybe I'm paranoid, but it still doesn't feel "safe" to me. Let's assume that KeePassX is truly unbreakable at the moment. I still fear losing my kdbx file, as if someday it will become vulnerable (maybe for technical reasons, or maybe just because of master-password exposure) I'd lose much more than any single of the accounts there: even if passwords there will be outdated already, it will be exposed that all these accounts belong to one person with known identity. All bank accounts, credit cards, email addresses, messengers, accounts on some shady forums. And if passwords are not outdated — oh my God…

It may be unlikely, but it's still putting all eggs in one basket. Just one failure, and you are truly fucked.

Re: Flaws in deterministic password managers

#67

Post by ythn »

eridius wrote: post #61
ythn wrote: post #49

Earlier quoted context omitted.

It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc

Yes, I know that Otto is Italian for 8. But even if I convert the italian word to the number, it doesn't make sense, because "8" doesn't have digits on either side of the digit so there's nothing to sum up.

7 and 9 are on either side of 8, and the sum is 16.

Re: Flaws in deterministic password managers

#68

Post by noir_lord »

krick wrote: post #66
Gee19 wrote: post #58

Earlier quoted context omitted.

This is only true for cloud based password managers. I recommend using 1Password or KeePassX with Dropbox.

Maybe I'm paranoid, but it still doesn't feel "safe" to me. Let's assume that KeePassX is truly unbreakable at the moment. I still fear losing my kdbx file, as if someday it will become vulnerable (maybe for technical reasons, or maybe just because of master-password exposure) I'd lose much more than any single of the accounts there: even if passwords there will be outdated already, it will be exposed that all these…

I guess you have to balance the probability of that kind of breach in Keepassx against the probability of fucking up and forgetting a password or reusing passwords (I still see this) across multiple services.

If you have an eidetic memory and can remember 20 digit random passwords for every service after securely generating them then keepassx increases your risk.

If however you behave like a 'normal' user and use the same one or three passwords on everything I'd estimated keepassx improves your security.

Re: Flaws in deterministic password managers

#69

Post by noir_lord »

IshKebab wrote: post #5
ythn wrote: post #3

The only deterministic password manager you need is your own mind. Come up with a set of password rules that are generic enough to accommodate all these issues. For example my deterministic password manager might be: 1. random english wordx2 + first 4 letters of registered domain, all caps + remaining lowercase + number of letters in domain (integer) + symbols associated with digits of the integer digits 2. If site d…

> If the site restricts passwords to max 12 characters The problem with this is that most sites are designed by idiots and don't state their pointless password rules on the login page - only on the 'change password' page. So you can be trying your coppercopperYCOMbinator11!! password and thinking "why the hell doesn't this work?", then after 10 minutes you give up and go to change it and see "Your password must be be…

GitHub got me every bloody time on my companies account with this because they required a case change iirc.

In the end I just changed it to something stupidly random and shoved it in keepassx, life's too short.

Re: Flaws in deterministic password managers

#70

Post by bradvo »

I agree with the author's opinion with the master password being compromised, you're done. I have found an elegant solution for managing my passwords with http://masterpasswordapp.com/ the iOS app is a breeze and I also use the export feature to backup my login names, hashed passwords, custom passwords, and stored secrets. This app in particular solves the author's third point. For the second point, I save the iteration X of a password as a stored secret when I need to revoke a password. It doesn't sacrifice the user experience in my opinion.
Post reply on HN